LinkedIn Data Breach (2012)

LinkedIn was hacked sometime in 2012; Have I Been Pwned gives only the year. At the time the damage looked contained: the incident was thought to have exposed about 6.5 million password hashes, without the email addresses that would make them usable. In May 2016 the whole set came up for sale for five bitcoins, a couple of thousand dollars, and it held 167 million accounts.

Troy Hunt wrote up what happened next on 24 May 2016. The price fell as copies spread. Crackers moved faster still: within days, about 86 percent of accounts had a recovered password, and over a million members turned out to share the same six-digit run of numbers as their password. LinkedIn emailed members, and was quoted as having invalidated the passwords of accounts created before the 2012 LinkedIn breach that had not been changed since.

Several people offered Troy Hunt the data within days, a sign it was circulating widely, so he loaded it into Have I Been Pwned: 164,611,595 unique addresses, added in May 2016.

A second, unrelated LinkedIn record followed in 2021. Attackers scraped public profiles during the first half of that year, and LinkedIn’s June 2021 statement said plainly that it was not a data breach and no private member data was exposed. Have I Been Pwned lists it anyway, as 125,698,496 addresses, because the profiles were matched to email addresses and sold.

Two records, two very different sets of data. From the 2012 LinkedIn data breach come only email addresses and password hashes, but those are the two fields that open accounts.

No passwords are in the 2021 scrape. It pairs email addresses with names, job titles, education levels, genders, geographic locations and social media profiles. That is a ready-made list for fake recruiters: a job pitch that fits your title, sent to your personal address.

LinkedIn stored its 2012 passwords as SHA-1 hashes without a salt. Unsalted means every member who chose the same password got the same hash, so one crack revealed every account sharing it, which is why a single common password could expose more than a million people at once.

SHA-1 is also fast, letting ordinary hardware try billions of candidates per second. Troy Hunt pointed out that the choice was already poor in 2012, and said he believed LinkedIn changed its hashing around the time of the original incident. That came too late for this set: if your LinkedIn password from that era was anything short of long and random, assume it is known.

Anything you used as a LinkedIn password before 2016 should be retired everywhere, because it is almost certainly in a cracked list now. Check the accounts you have had longest, your email above all, and add two-factor sign-in to LinkedIn itself.

For the 2021 record there is nothing to change, only something to watch: be wary of job offers and contact requests that know your title and school but arrive at an address you never put on your profile. Then run the free LeakNix check to find which other breaches hold that address.